CVE-2022-28787: 
NixOS vulnerability analysis and mitigation

Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The vulnerability was assigned CVE-2022-28787 and was discovered in early 2022. The affected systems include Android versions 10.0, 11.0, and 12.0 (NVD).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) with a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Samsung Mobile assessed it with a lower CVSS score of 4.0 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vulnerability stems from improper buffer size checking in the wmfextractor library (NVD).

The vulnerability can lead to a temporary denial of service through out-of-bounds read operations. The impact is primarily on the availability of the system, with no direct impact on confidentiality or integrity (NVD).

The vulnerability was patched in SMR May-2022 Release 1. The fix includes the addition of proper buffer size check logic to prevent out-of-bounds read operations (Samsung Mobile).